Commit 22878dbc9173a7f0322dd697b1b5b49a83a1d4d5
Committed by
Roland Dreier
Roland Dreier
1 parent
f77c0162a3
Exists in
smarc-imx_3.14.28_1.0.0_ga
and in
1 other branch
IB/core: Better checking of userspace values for receive flow steering
- Don't allow unsupported comp_mask values, user should check
ibv_query_device to know which features are supported.
- Add a check in ib_uverbs_create_flow() to verify the size passed
from the user space.
Signed-off-by: Matan Barak <matanb@mellanox.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Showing 2 changed files with 17 additions and 1 deletions Side-by-side Diff
drivers/infiniband/core/uverbs_cmd.c
| ... | ... | @@ -2652,17 +2652,31 @@ |
| 2652 | 2652 | if (copy_from_user(&cmd, buf, sizeof(cmd))) |
| 2653 | 2653 | return -EFAULT; |
| 2654 | 2654 | |
| 2655 | + if (cmd.comp_mask) | |
| 2656 | + return -EINVAL; | |
| 2657 | + | |
| 2655 | 2658 | if ((cmd.flow_attr.type == IB_FLOW_ATTR_SNIFFER && |
| 2656 | 2659 | !capable(CAP_NET_ADMIN)) || !capable(CAP_NET_RAW)) |
| 2657 | 2660 | return -EPERM; |
| 2658 | 2661 | |
| 2662 | + if (cmd.flow_attr.num_of_specs < 0 || | |
| 2663 | + cmd.flow_attr.num_of_specs > IB_FLOW_SPEC_SUPPORT_LAYERS) | |
| 2664 | + return -EINVAL; | |
| 2665 | + | |
| 2666 | + kern_attr_size = cmd.flow_attr.size - sizeof(cmd) - | |
| 2667 | + sizeof(struct ib_uverbs_cmd_hdr_ex); | |
| 2668 | + | |
| 2669 | + if (cmd.flow_attr.size < 0 || cmd.flow_attr.size > in_len || | |
| 2670 | + kern_attr_size < 0 || kern_attr_size > | |
| 2671 | + (cmd.flow_attr.num_of_specs * sizeof(struct ib_kern_spec))) | |
| 2672 | + return -EINVAL; | |
| 2673 | + | |
| 2659 | 2674 | if (cmd.flow_attr.num_of_specs) { |
| 2660 | 2675 | kern_flow_attr = kmalloc(cmd.flow_attr.size, GFP_KERNEL); |
| 2661 | 2676 | if (!kern_flow_attr) |
| 2662 | 2677 | return -ENOMEM; |
| 2663 | 2678 | |
| 2664 | 2679 | memcpy(kern_flow_attr, &cmd.flow_attr, sizeof(*kern_flow_attr)); |
| 2665 | - kern_attr_size = cmd.flow_attr.size - sizeof(cmd) - sizeof(struct ib_uverbs_cmd_hdr_ex); | |
| 2666 | 2680 | if (copy_from_user(kern_flow_attr + 1, buf + sizeof(cmd), |
| 2667 | 2681 | kern_attr_size)) { |
| 2668 | 2682 | err = -EFAULT; |
include/rdma/ib_verbs.h